Overview

overview

10

Static

static

10

19a1a8c17a...37.exe

windows7-x64

10

19a1a8c17a...37.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    19a1a8c17a283045085e7213931f0282680aa0202b54fa37cc47a043f27cb637

  • Size

    103KB

  • Sample

    231011-y39gvabb6y

  • MD5

    da9b1c76e8d8c3c1e873f0d56daa097a

  • SHA1

    eaf7daa24e4bd79cd7e67cf3c890e4ddf8fccdc2

  • SHA256

    8388c2b49c217ef9f0e0adb99f86ac30b93dfb91fd84c4da2bdb03d0149d4388

  • SHA512

    1181f86b759dbda8a4797afc0b25d9e72638094af4b139480788ee7ceb3bbf9eff060b92ac73a424ed40df911ff32b7b875faf8e3565fa80a59c16db6d26e330

  • SSDEEP

    3072:5LTzrHEDjomznpCacXyS+ZLRyy4c1m6J/g:5LXmD8hX8ZNyCm6xg

Score
10/10
amadeytrojan

Malware Config

Extracted

Family

amadey

Version

3.89

C2

http://77.91.68.52/mac/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explonde.exe

  • strings_key

    916aae73606d7a9e02a1d3b47c199688

rc4.plain

Targets

    • Target

      19a1a8c17a283045085e7213931f0282680aa0202b54fa37cc47a043f27cb637

    • Size

      237KB

    • MD5

      4187e496df2ae01cc6ccf5fc9bd68fe2

    • SHA1

      ff5861d8842b092cf470008233df97e5d0501832

    • SHA256

      19a1a8c17a283045085e7213931f0282680aa0202b54fa37cc47a043f27cb637

    • SHA512

      f9fa5bf10f17e4dd9905332c50346a4a1f8ddd3c9c3802041dd71a5fb803d44080555947ce7134d6651c20177389c07dfdbc3c1e1c4406b8fdb65a09bc6561f3

    • SSDEEP

      6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2

    Score
    10/10
    amadeytrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks